Full text
Holding. Holding TBD.. First Question: . The court underlined the obligation under Article 57(1)(f) GDPR requiring DPA’s to handle complaints lodged pursuant to Article 77 GDPR. Apparent from this obligation is the fact that DPA’s with which a complaint is lodged must process the personal data of the data subject. Therefore, that data is recorded, consulted, stored and used by the DPA. Evidently, the powers afforded to DPA’s by EU law also implicitly affords them to determine the purposes and means of processing in regards to the handling of the complaint. The court establishes therefore that a DPA must be regarded as a controller of the personal data of the data subject within the meaning of Article 4(7) GDPR. The court further emphasised the broad definition of ‘controller’ the purpose to ensure the effective and complete protection of data subjects and the processing of their personal data. In that regard, if a DPA was not classified as a controller concerning the personal data proc